International Business Machines Corporation

Kyndryl, Inc.

Kyndral, Inc.

Richard Jay Cohen

Anne Louise Bolgert

Krishna Kishore Yellepeddy

Miguel Sang

Maja Vukovic

Constantin Mircea Adam

Sai Zeng

Milton H Hernandez

Robert Filepp

Brian L Peterson

Bhavna Agrawal

Theodore Jack London Shrader

Guan Zhang

Ivan Matthew Milman

Heather Maria Hinton

Randolph Michael Forlenza

Lohitashwa Thyagaraj

George Robert Blakley, Iii

Raghuraman Kalyanaraman

Debasisha Padhi

Gregory Alan Wilson

Umesh Gopaldas Khatwani

Andrea L Snow-Weaver

Jeffrey Edward Lammers

Woodrow Wyatt Arkeketa

Christopher James Pascoe

John Robert Meckstroth

Brian Peterson

Guan Qun Zhang

Robert Delee Bones

Xiongfei Wei

Paul Kallfelz

Cheng Yi Lee

Richard Allen Forsberg

Randolf Michael Forlenza

Paul A Kallfelz, Jr

Users of an endpoint remediation system can be assigned to different roles, from which they can request exceptions, approve exceptions, and/or enable remediation on endpoint devices. The compliance scanning and enforcing process can be automated, while allowing entities to request and/or approve certain exceptions. Therefore, security compliance for customers can be actively managed to provide visibility to the endpoint device compliance state at any time.

Testing and remediating endpoint device compliance controls

A method, system, and computer program product for prioritizing endpoints to be checked during a change window based on certain criteria. The method may include receiving a request for processing from a plurality of servers. The method may also include determining a priority for each server of the plurality of servers based on specified criteria, where the specified criteria includes at least compliance-check history. The method may also include determining whether each server belongs to one or more groups. The method may also include determining a notification order for the plurality of servers based on the priority and whether each server belongs to the one or more groups. The method may also include sending a notification to each server in the notification order.

Prioritize endpoint selection based on criteria

Testing and remediating compliance controls

Using a first key, an encrypted file fingerprint is decrypted, the decrypting resulting in a decrypted file fingerprint. Using a hash function on a script file, a script file fingerprint is computed, the script file intended to be executed by an interpreter. Responsive to the script file fingerprint matching the decrypted file fingerprint, the script file is executed.

Preventing untrusted script execution

Systems and methods for identifying and remediating malware-compromised mobile devices are disclosed. A computer-implemented method includes accessing, by a computing device, malware risk data; determining, by the computing device, a mobile device is at risk from malware based on the malware risk data; identifying, by the computing device, a set of connections of a user of the mobile device, wherein each connection in the set of connections is associated with a user computer device; identifying, by the computing device, at least one user computer device from the set of connections at risk from the malware; and outputting, by the computer device, a malware notification for the mobile device at risk and at least one user computer device at risk.

Identifying and remediating malware-compromised devices

This disclosure describes an automated process of discovering characteristics needed to integrate a web-based application to a web portal, such as a reverse proxy. This process eliminates the need for application owners and security analysts to manually discover the information needed for the on-boarding process. To this end, application-specific information is determined by monitoring network traffic flows in and out of the application, user authentication and authorization event data, and the like. An application discovery engine analyzes the discovered data, preferably against a set of patterns and heuristic-based rules, to discover or identify the one or more application characteristics. A set of configuration data is then generated, and this configuration data is then used to integrate the application into the web reverse proxy and, in particular, by specifying the configuration needed to 'board' the application. Preferably, the monitoring and application characterization determination functions occur in an automated manner.

Auto-detection of web-based application characteristics for reverse proxy enablement

A cloud enablement aggregation proxy (CEAP) receives and processes audit data from audited resources before such data is stored in a database. The CEAP manages log data for resources hosted in a multi-tenant shared pool of configurable computing resources (e.g., a compute cloud). A method for managing log data begins by the proxy aggregating and normalizing log information received from a plurality of the resources. The aggregated and normalized log information is then parsed to identify a tenant associated with each of a set of transactions. For each of the set of transactions, the CEAP annotates log data associated with the tenant and the particular transaction to include a tenant-specific identifier. An optional tenant separation proxy (TSP) separates the annotated log data on a per tenant basis prior to storage, and the tenant-specific log data may be stored in per tenant data structures or dedicated tenant log event databases to facilitate subsequent compliance or other analysis.

Multi-tenant audit awareness in support of cloud environments

Gathering auditable data concerning actions in a cloud computing environment is automated by determining that one or more auditable data items are available associated with a requester and with at least one application program; responsive to determining that data items are available, transmitting a list of the available auditable data items to a requesting cloud client computer; subsequent to transmitting the list, receiving a data request from the cloud client computer for one or more particular auditable data items from the list; preparing the requested particular auditable data items for transmission according to a predetermined format; and transmitting the prepared requested particular auditable data items to the cloud client computer. Optionally, in some embodiments, the requesting cloud client computer may negotiate a data exchange format with the cloud service provider for receipt of the requested auditable information.

Supporting compliance in a cloud environment

Method, instructions and system for establishing and enforcing change password policy in a single sign-on environment. In response to receiving a change instruction identifying a first single sign-on password, the first single sign-on password is changed to create a second single sign-on password. Then a target password is retrieved. The target password is modified in a user selected manner to match the second single sign-on password to create a modified target password. The modified target password is stored. In response to a request from a user requesting access to an application, the modified target password is retrieved and the modified target password is provided to the requested application.

Incorporating password change policy into a single sign-on environment

A frames-based Web browser is used with existing distributed computing environment (DCE) interfaces to facilitate and simplify management of DCE cells. In the preferred embodiment, administration may be performed from any secure Web browser acting as a client. Management data is typically supported on a target Web server. At the browser, CGI scripts are used to dynamically generate HTML (hypertext markup language) pages based on the network administrator's selections and the current state and defined objects in the DCE cell. The result is a robust and efficient Web-based DCE management scheme.

Method and system for web-based DCE management

A method and apparatus in a distributed data processing system for managing memory in a data processing system within the distributed data processing system. Responsive to detecting a first level of memory shortage on the data processing system, a first set of monitors is automatically stopped on the data processing system. Responsive to detecting a second level of memory shortage on the data processing system, a second set of monitors is stopped on the data processing system. Responsive to detecting a ceasing of the memory shortage, all stopped monitors are automatically started.

Method and apparatus for managing a memory shortage situation in a data processing system

Growing community of inventors

Austin, TX, United States of America

Richard Jay Cohen